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CROSS REFERENCE TO RELATED APPLICATIONS 
The present document claims priority to Japanese Priority 
Document JP2002-277285, filed in the Japanese Patent Office on 
September 24, 2002, the entire contents of which are incorporated herein 
by reference to the extent permitted by law. 



10 BACKGROUND OF THE INVENTION 

1. Field of the Invention 

The present invention relates to a semiconductor integrated circuit, 
such as an LSI, and particularly to a semiconductor integrated circuit in 
which a scan circuit is provided, and to a method of testing the same. 
15 2. Description of the Related Art 

Scan testing has conventionally been known as a method of testing 

LSIs. 

Fig. 4 shows a model of a semiconductor integrated circuit (LSI) on 
which scan testing can be performed. Various logical circuits are 
20 constructed as internal circuitry 60 in this LSI, and input data from, for 
example, input terminals in 1 through in 4 are computed by the internal 
circuitry 60. Then, the computed result is outputted from output 
terminals out 1 through out 4. 

In such an LSI, in order to make scan testing possible, scan 
25 flip-flops (hereinafter referred to as FFs) 61 through 68 are provided as 
shown in the figure. These scan FFs 61 through 68 are, for example, 
flip-flops having the functions of a multiplexer, and a given required 
number of scan flip-flops are serially connected between a scan input 
terminal (scan in) and a scan output terminal (scan out). This serial 
30 connection is called a scan chain. 

By inputting a scan data pattern from the scan input terminal 
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(scan in), the scan flip-flops 61 through 64 are set to arbitrary values as 
input for the internal circuitry 60. The values that are set are processed 
by the internal circuitry 60, and result data thereof are outputted to the 
scan flip-flops 65 through 68. Then, data on the scan chain are shifted, 
5 and the result data outputted from the scan output terminal (scan out) are 
checked. Through such a method, LSIs are tested for defects. 

Fig. 4 shows an extremely simplified model of scan testing. 
Various scan testing methods are described in, for example, the documents 
below. 

10 [Patent Document l] Japanese Patent Application Publication 

Sho-63- 134970 

[Patent Document 2] Japanese Patent Application Publication 
Hei-4-72583 

[Patent Document 3] Japanese Patent Application Publication 
15 Hei-5- 172897 

[Patent Document 4] Japanese Patent Application Publication 
Hei-4-287510 

SUMMARY OF THE INVENTION 
20 However, with a LSI in which a scan circuit, such as the scan chain 

mentioned above, is inserted, because the value of a register within a LSI 
under operation can be outputted externally, and data can be inputted to a 
register from outside, the following inconveniences may arise. 

For example, considering an LSI that handles security data such 
25 as encryption codes, when a scan operation is performed while data are 
being transmitted/received and loaded to a register, there is a possibility 
that the security data may be outputted externally via the scan chain. In 
other words, by using the scan chain configuration, there is some risk of 
having security data extracted. 
30 Similarly, by performing a scan operation while security data 

related to reception or the like are being written in an internal RAM, there 
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is a possibility that that security data may be outputted externally via the 
scan chain. 

Further, under normal mode, there is a risk of having data 
extracted by controlling the shift enable signal by some method and 
5 performing a scan chain shift operation. 

In addition, because it is possible to input data using the scan 
chain, one cannot say for sure that unauthorized operation of the LSI 
would not occur by writing data in an internal register or RAM via the 
scan chain, thereby altering data such as encryption codes, which is called 
10 "spoofing." 

In other words, especially with respect to LSIs that handle 
security data such as encryption codes, providing a scan chain and making 
scan tests possible entails the risk of unauthorized access to security data, 
having encryption codes cracked, or occurrences of spoofing through data 
15 tampering. 

On the other hand, unless scan testing is performed, high quality 
LSI testing becomes difficult and becomes a problem in manufacturing. 

In view of such problems, the present invention seeks to provide a 
semiconductor integrated circuit which makes scan testing possible while 

20 preventing unauthorized access to or alteration of security data stored 
internally in the LSI. 

In other words, a semiconductor integrated circuit according to an 
embodiment of the present invention is a semiconductor integrated circuit 
having a normal operation mode and a test mode for scan testing internal 

25 logical circuitry. The semiconductor integrated circuit includes- a 
plurality of flip-flops arranged so as to perform scan testing on the 
internal logical circuitry mentioned above; and reset means for resetting 
the plurality of flip-flops mentioned above when transitioning from the 
normal mode mentioned above to the test mode mentioned above in 

30 accordance with a mode signal for selectively specifying the normal 
operation mode or the test mode by its logical level. 
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The reset means mentioned above also resets the plurality of 
flip-flops mentioned above when transitioning from the test mode to the 
normal operation mode in accordance with the mode signal mentioned 
above. 

5 The semiconductor integrated circuit may further include output 

control means that is connected serially to the plurality of flip-flops 
mentioned above and which outputs data that is supplied during the test 
mode and prohibits the outputting of data that is supplied during the 
normal operation mode. 
10 The semiconductor integrated circuit may further include memory 

means connected to the plurality of flip-flops mentioned above and access 
control means for prohibiting access to the memory means mentioned 
above during the test mode in accordance with the mode signal mentioned 
above. 

15 The semiconductor integrated circuit may further include 

transition detection means for detecting the transition timing of the 
logical level of the mode signal mentioned above, and the reset means 
mentioned above resets the plurality of flip-flops when the transition 
detection means detects the transition timing. 

20 A semiconductor integrated circuit according to an embodiment of 

the present invention is a semiconductor integrated circuit having a test 
mode for scan testing an internal logical circuitry and a normal operation 
mode, and it includes' a plurality of flip-flops arranged so as to perform 
scan testing on the internal logical circuitry mentioned above; and reset 

25 means for resetting the plurality of flip-flops mentioned above when 
transitioning from the test mode to the normal operation mode in 
accordance with a mode signal for selectively specifying the normal 
operation mode or the test mode by its logical level. 

The semiconductor integrated circuit further includes transition 

30 detection means for detecting the transition timing of the logical level 
mentioned above of the mode signal, and the reset means mentioned 
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above resets the plurality of flip-flops when the transition detection means 
detects the transition timing. 

A semiconductor integrated circuit according to an embodiment of 
the present invention is a semiconductor integrated circuit having a test 
5 mode for scan testing internal logical circuitry and a normal operation 
mode, and it includes- a plurality of flip-flops arranged so as to perform 
scan testing on the internal logical circuitry mentioned above; and output 
control means, which is connected serially to the plurality of flip-flops 
mentioned above, for outputting data that is supplied during the test 

10 mode and prohibiting the outputting of data that is supplied during the 
normal operation mode. 

A semiconductor integrated circuit according to an embodiment of 
the present invention is a semiconductor integrated circuit having a test 
mode for scan testing internal logical circuitry and a normal operation 

15 mode, and it includes^ a plurality of flip-flops arranged so as to perform 
scan testing on the internal logical circuitry mentioned above! memory 
means connected to the plurality of flip-flops mentioned above; and 
access control means for prohibiting, in accordance with a mode signal for 
selectively specifying the normal operation mode or the test mode by its 

20 logical level, access to the memory means mentioned above during the test 
mode. 

A testing method according to an embodiment of the present 
invention is a testing method for an integrated circuit having a test mode 
for scan testing and a normal mode, and which includes internal logical 

25 circuitry and a plurality of flip-flops for scan testing the internal logical 
circuitry. The testing method resets the plurality of flip-flops mentioned 
above upon transition from the normal operation mode to the test mode. 

The testing method also resets the plurality of flip-flops upon 
transition from the test mode to the normal operation mode. 

30 A testing method according to an embodiment of the present 

invention is a testing method for an integrated circuit including an 
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internal logical circuitry, a plurality of flip-flops for scan testing the 
internal logical circuitry mentioned above, and memory means connected 
to the plurality of flip-flops mentioned above and which has a test mode 
for performing the scan test mentioned above, and a normal operation 
5 mode. During the test mode, access to the memory means mentioned 
above is prohibited. 

According to the embodiments of the present invention above, 
flip-flops constituting a scan chain are reset when scan testing is initiated 
or terminated by a mode signal for switching between a normal operation 
10 state and a scan operation state. In other words, scan operations are 
initiated or terminated in a state where no data are left behind in the 
flip-flops. 

In addition, it is made impossible to access the internal memory 
means utilizing scan test operations during scan testing. 
15 Further, according to the embodiments of the present invention 

above, the output control means connected serially to the plurality of 
flip-flops operates to output data only during scan testing, and it is unable 
to output, or, for example, shift out, data by the scan chain during normal 
operation. 

20 As can be understood from the description above, the following 

advantages may be obtained from embodiments of the present invention. 

The flip-flops constituting the scan chain are reset when scan 
testing is initiated in accordance with the mode signal for selectively 
specifying the normal operation mode or the test mode. Therefore, 

25 because scan operations are initiated under a condition in which the data 
that was held by the flip-flops during the normal operation mode are not 

♦ 

left behind, it becomes impossible to extract data using scan test 
operations during the normal operation mode. 

Further, because the flip-flops constituting the scan chain are 
30 reset when scan testing is terminated, transitioning to the normal 
operation mode in a state in which the data that was loaded to the 
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flip-flops during scan test operations are left behind is prevented. 
Therefore, loading the data using scan test operations and then 
performing normal operations can be prevented. 

In addition, the internal memory means cannot be accessed using 
5 scan test operations during scan testing. For this reason, accessing 
memory means, such as a RAM and the like, using scan test operations 
during scan testing, thereby reading data in the memory means via the 
scan chain, or writing arbitrary values to the memory means and 
transitioning to normal operations is made impossible. Thus, the 

10 extraction of security data, such as encryption codes and the like, or 
spoofing by way of tampering with data is prevented. 

Further, by providing the output control means, which is 
connected serially to the scan chain, for outputting data that are supplied 
during the test mode and prohibiting the outputting of data that are 

15 supplied during the normal operation mode, shifting out by the scan chain 
during the normal operation mode is made impossible. For this reason, 
the reading of the values of the internal flip-flops by a shift out using the 
scan chain by altering only the scan enable signal during normal 
operation mode can be prevented. 

20 Thus, the leakage of values of the internal register of the LSI 

. (semiconductor integrated circuit) using the scan chain or scan test 
operations can be prevented, and, also, performing normal operations 
after setting values in the LSI internal register or memory using scan test 
operations can be prevented. Therefore, even LSIs that handle security 

25 data, such as encryption keys and the like, may have their circuits 
configured so as to be scan testable without giving rise to security issues. 
In other words, a semiconductor integrated circuit (LSI) that is suitable 
for manufacture and that can be scan tested without lowering its level of 
security may be realized. 

30 

BRIEF DESCRIPTION OF THE DRAWINGS 
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Fig. 1 is a circuit diagram of a main portion of a LSI according to 
an embodiment of the present invention; 

Fig. 2 is a wave form chart illustrating the resetting operation of a 
scan chain on an embodiment of the present invention; 
5 Fig. 3 is a wave form chart illustrating the motion for the creation 

of a scan pattern on an embodiment of the present invention! and 

Fig. 4 is an illustrative diagram of the scan operation. 

DESCRIPTION OF THE PREFERRED EMBODIMENTS 
10 An LSI 1 as an embodiment of a semiconductor integrated circuit 

of the present invention and which executes the testing method of the 
present invention will be described below. 

The configuration of a main portion of the LSI 1 is shown in Fig. 1. 
It is to be noted that in Fig. 1, the circuit system corresponding to the 
15 internal circuitry 60 described with reference to Fig. 4, in other words, the 
main logical circuit system of the LSI 1, is not shown, and only portions 
that directly concern the present invention are shown. 

In the LSI 1, there are provided a scan in terminal 5 and a scan 
out terminal 6. A scan chain including scan flip-flops 41-1 through 41-n 
20 and a dummy flip-flop 32 is formed between the scan in terminal 5 and the 
scan out terminal 6. 

Each of the scan flip-flops 41-1 through 41-n is a flip-flop having 
the functions of a multiplexer, and, as in the scan flip-flops 61 through 68 
for the internal circuitry 60 shown in Fig. 4, is connected to internal 
25 circuitry that is now shown, and is configured so as to make scan testing 
possible. Thus, in Fig. 1, only the scan shift path shown with the broken 
line in Fig. 4 is shown. 

During scan testing, a scan pattern is inputted to the scan 
flip-flops 41-1 through 41-n from the scan in terminal 5. By a shift out of 
30 the scan chain, data that is to be checked for scan testing are shifted out 
from the scan out terminal 6. 
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Flip-flops with asynchronous reset are used for the scan flip-flops 
41-1 through 41-n and the dummy flip-flop 32. 

A scan mode signal is inputted to a scan mode input terminal 2. 
The scan mode signal is a signal for switching the LSI 1 between a normal 
5 operation state and a scan operation state. In the present example, when 
the scan mode signal is "L," the LSI 1 enters the normal operation state, 
and when the scan mode signal is "H," the LSI 1 enters the scan operation 
state. 

A system clock of the LSI 1 is inputted to. a clock input terminal 3. 
10 In the present example, the system clock also is used as a scan clock 
during a scan operation. In other words, the system clock from the clock 
input terminal 3 is used directly as an operation clock for the scan 
flip-flops 41-1 through 41-n. 

A reset signal for internally resetting the LSI 1 is inputted from a 
15 reset input terminal 4. The internal circuitry not shown in the figure is 
reset in accordance with the reset signal supplied from outside. 

The LSI 1 shown in Fig. 1, due to its configuration, has the 
following three characteristics 1 
(l) Reset control for the flip-flops of the scan chain. 
20 (2) Access prohibition control for the internal memory means (RAM l) 
during scan operation; and 
(3) Output control by the dummy flip-flop 32. 
These points will be described below. 



25 <(l) Reset Control for the Flip-Flops of the Scan Chain> 

As shown in the figure, flip-flops 21 and 22, an EX-OR gate 23 and 
an AND gate 24 are provided as a reset control block 20. 

The flip-flops 21 and 22 and the EX-OR gate 23 are provided to 
detect the transition timing of the logical level of the scan mode signal. 
30 The flip-flops 21 and 22 operate on the system clock from the input 

terminal 3. The flip-flop 21 of the first stage latches the scan mode signal, 
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and the flip-flop 22 in the subsequent stage latches the latched output of 
the flip-flop 21. 

At the EX-OR gate 23, the XOR (inverted output) of the latched 
output of each of the flip-flops 21 and 22 is obtained and supplied to the 
5 AND gate 24. Another terminal of the AND gate 24 is connected to the 
reset input terminal 4, and an external reset signal is supplied to the AND 
gate 24. 

The AND output of the AND gate 24 is taken to be a reset signal 
for the scan flip-flops 41-1 through 41-n and the dummy flip-flop 32. 
10 ' The operation of the reset control block 20 is described with 

reference to Fig. 2. 

Fig. 2A shows the scan mode signal. The LSI enters the scan 
operation mode when the scan mode signal is "H." 

In the reset control block 20, because the flip-flops 21 and 22, as 
15 described above, operate on the system clock shown in Fig. 2B, latch the 
scan mode signal, and output via the EX-OR gate 23, an edge detection 
signal shown in Fig. 2C is obtained in correspondence with the rising edge 
and the falling edge of the scan mode signal. 

In addition, by adopting a configuration in which the latched 
20 output of the two-staged flip-flops 21 and 22 is outputted via the EX-OR 
gate 23, the outputted edge detection signal (L level) is made to have a 
pulse length that is at least equal to or greater than one clock period of the 
system clock. 

Because the edge detection signal is supplied to the scan flip-flops 
25 41-1 through 41-n and the dummy flip-flop 32 via the AND gate 24, the 
scan flip-flops 41-1 through 41*n and the dummy flip-flop 32 are reset in 
accordance with the rising and the falling of the scan mode signal as 
shown in Fig. 2E by the edge detection signal of an L level. 

In addition, when a reset signal (L level), as shown in Fig. 2D, is 
30 inputted from the reset input terminal 4, because this reset signal is 
supplied to the scan flip-flops 41-1 through 41-n and the dummy flip-flop 
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32 via the AND gate 24, these flip-flops are reset as shown in Fig. 2E with 
external reset inputs as well. 

Thus, the scan flip-flops 41-1 through 41-n and the dummy 
flip-flop 32 are reset in accordance with the edge timing of the scan mode 
5 signal, in other words, upon transition from the normal operation state to 
the scan operation state, as well as from the scan operation state to the 
normal operation state. 

Therefore, it is made impossible to perform scan operations 
without resetting at the time of initiating scan operations, or to make the 
10 LSI 1 perform normal operations without being reset upon termination of 
scan operations. 

In the LSI 1 of the present invention in which the scan circuit is 
inserted, by shifting out the data of the scan flip-flops 41-1 through 41-n 
using the scan chain when entering a scan operation from a normal 
15 operation, there is the risk that the status of the scan flip-flops 41-1 
through 41-n during a normal operation just before entering a scan 
operation gets externally outputted. This means that there is a 
possibility that security data, such as encryption keys and the like, may be 
leaked. 

20 As such, in the present example, by initializing the internals of the 

LSI by resetting upon entering the scan mode based on the rising edge of 
the scan mode signal as described above, it can be made impossible to shift 
out the data held during normal operations. 

In addition, by inserting the scan circuit, it becomes possible to 

25 load data to the scan flip-flops 41-1 through 41-n via the scan chain from 
outside during scan operations. If a transition is then made to normal 
operations, it is possible to make the LSI 1 perform normal operations 
using the loaded data. As a result, there is a possibility that security 
data, such as encryption codes and the like, becomes altered and used. 

30 As such, in the present example, this is prevented by resetting 

upon termination of the scan mode as well and initializing the internals of 
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the LSI 1 based on the falling edge of the scan mode signal as described 
above. 

The edge detection signal, which serves as the reset signal, is 
made to have a pulse length that is, as described above, at least equal to or 
5 greater than one clock period of the system clock. Thus, it is ensured 
that the scan flip-flops 41-1 through 41-n are reset reliably. 

In the present example, the system clock is used directly as the 
scan clock, and the system clock also is used for edge detection in the reset 
control block 20. The reasons for this are described below. 

10 For example, if the scan clock and the system clock are made 

distinct, and a rising/falling edge detection circuit (flip-flops 21 and 22 and 
the EX-OR gate 23) for the scan mode signal is configured using a clock 
that is not used during scan operations (the system clock, for example), 
once the transition is made from normal operations to scan operations, 

15 scan operations can be performed without inputting a clock to the edge 
detection circuit. For this reason, no resetting is performed at the time of 
initiating scan operations, and this gives rise to the risk of making it 
possible to externally output the values of the internal registers. 

On the other hand, if the rising/falling edge detection circuit for 

20 the scan mode signal is configured using a clock that is not used during 
normal operations (the scan clock, for example), when scan operations are 
terminated, a normal operation can be performed without inputting a 
clock to the edge detection circuit. As a result, the LSI may be operated 
with arbitrary values set in the register from outside. 

25 In the present example, in order to prevent such problems, the 

same clock is used during both system operations and scan operations, 
and that clock (the system clock) is inputted to the rising/falling edge 
detection circuit for the mode signal. 

In the present example, when creating scan patterns, two clocks of 

30 the system clock may be inputted once the scan mode is entered. Wave 
forms similar to those of Fig. 2A through Fig. 2E are shown in Fig. 3A 
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through Fig. 3E. However, since the resetting is undone when two clocks 
of the system clock are inputted, scan operations can be performed 
thereafter, that is, after Tl. 

Thus, two clocks are initially inputted in the present method of 
5 creating a scan pattern. 

<(2) Access Prohibition Control for Internal Memory Means During Scan 
Operations> 



10 means during scan operations will be described. 

As the RAM control block 10 shown in Fig. 1, a RAM 11 and an OR 
gate 12 are provided. It is assumed that RAM 11 is, for example, a 
memory section where security data is stored. The RAM 11 is controlled 
so as to be accessible or inaccessible by a chip enable signal XCE inputted 

15 to a chip enable terminal 11a. In this case, the chip enable signal XCE is 
active at the low level. 

During normal operations, the chip enable signal XCE generated 
by the internal circuitry of the LSI 1 is supplied to the chip enable 
terminal 11a via the OR gate 12, and access control of the RAM 11 is 

20 performed. 

Further, in the present example, the scan mode signal is supplied 
to the chip enable terminal 11a via the OR gate 12. 

As described above, by an "H" scan mode signal, the LSI 1 is placed 
in scan mode. Since the chip enable terminal 11a has an active low 
25 configuration, during scan operation periods, access prohibition control for 
the RAM 11 is maintained. 

As in the present example, in an LSI in which a scan circuit is 
inserted, during scan operations, there is a possibility that data in an 
internal RAM may be read via a scan chain by accessing the internal RAM 
30 utilizing scan operations or that normal operations are performed after 
writing arbitrary values in the internal RAM. Thus, in the present 



Next, the access prohibition control for the internal memory 
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example, by using the scan mode signal as the chip enable signal, the 
RAM 11 is made inaccessible during scan operations. 

Although in Fig. 1, the RAM 11 was used as an example, a ROM 
internal to the LSI, a flash memory and the like may be made inaccessible 
5 during scan operations by a similar method, thereby protecting stored 
security data and the like. 

<(3) Output Control by Dummy Flip-Flop> 

Next, output control by the dummy flip-flop 32 will be described. 
10 A dummy flip-flop control block 30 shown in Fig. 1 is provided as 

an output control means for the scan chain configured with the scan 
flip-flops 41-1 through 41-n. 

As shown in Fig. 1, an AND gate 31 is provided as the dummy 
flip-flop control block 30, and the output of the AND gate 31 is taken to be 
15 the clock of the dummy flip-flop 32. 

The AND gate 31 performs a logical AND operation on the system 
clock and the scan mode signal. 

Because the LSI 1 enters scan mode when the scan mode signal is 
"H," the AND gate 31 supplies the system clock to the dummy flip-flop 32 
20 only during scan operation periods. 

In other words, the clock is not supplied to the dummy flip-flop 32 
during a normal operation state and, thus, does not operate. 

The dummy flip-flop 32 is connected to the final stage of the scan 
chain. Therefore, the fact that the dummy flip-flop 32 does not operate 
25 during normal operations means that shifting out using the scan chain 
cannot be done during normal operations. 

The resetting by the detected edges of the scan mode signal 
mentioned above is not a security measure for shifting out during normal 
operations. 

30 In addition, by being scan shifted by switching only the scan 

enable signal during normal operations, there is a possibility that the 
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values of the internal scan flip-flops 41-1 through 41-n can be read using 
the scan chain. 

In order to prevent such unauthorized reading of data during 
normal operations, in the present example, shifting out is made 
5 impossible during normal operations by connecting a dummy flip-flop 32, 
which operates only during scan operations, to the final stage of the scan 
chain. 

Although in the present invention, the configuration is such that 
one dummy flip-flop 32 is connected to the final stage of the scan chain, 
10 other connective positions and numbers for the dummy flip-flop 32 are 
conceivable. 

In other words, for example, the dummy flip-flop 32 may be located 
in a stage subsequent to a flip-flop that handles security data to protect 
only the security data. 
15 In addition, the output control means may be configured by 

arranging an AND gate(s), instead of the dummy flip-flop 32, in an 
appropriate manner, and similar advantages can still be obtained by 
preventing data from being outputted to the scan out terminal 6 during 
normal operations. 

20 Thus, three characteristic configurations of the present 

embodiment have been described. With such configurations, the LSI 1 is 
provided with a scan chain, thus making scan operations possible, while 
also preventing data leakage due to the scan chain or unauthorized 
rewriting of data from outside. Therefore, the LSI can be tested using 

25 scan methods without lowering its security level, and a LSI that is 
suitable for use in handling security data can be provided. 

In Fig. 1, a configuration in which the three functions of (l) reset 
control of the scan chain, (2) access prohibition control for the internal 
memory means during scan operations, and (3) output control by the 

30 dummy flip-flop are realized is shown. However, by simply providing at 
least one of these functions, an LSI equipped with a scan circuit and which 
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has high security functions can be provided. Which of the three functions 
should be provided may be decided depending on the intended application 
of the LSI being designed, its circuit configuration or scale, data to be 
handled, the demanded level of security and the like. 

Further, it should be obvious that for the reset control block 20, the 
RAM control block 10 and the dummy flip-flop control block 30, various 
configurations, such as the kind or number of registers and gates to use, 
for example, are conceivable. 

Since the invention disclosed herein may be embodied in other 
specific forms without departing from the spirit or general characteristics 
thereof, some of which forms have been indicated, the embodiments 
described herein are to be considered in all respects illustrative and not 
restrictive. The scope of the invention is to be indicated by the appended 
claims rather than by the foregoing description, and all changes which 
come within the meaning and range of equivalents of the claims are 
intended to be embraced therein. 
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